General
-
Target
f4f953a7b360535eddf20493ca42b947ee72ebc0bf789fc3b47c4380625af48f.exe
-
Size
930KB
-
Sample
241112-zbad4s1aqh
-
MD5
5ccc39fac47e68e392a6d0ec8718f634
-
SHA1
68fa1e22eeebefd68a0904b9ec824925fbbce5ef
-
SHA256
f4f953a7b360535eddf20493ca42b947ee72ebc0bf789fc3b47c4380625af48f
-
SHA512
34bc55db67e65b00df30a04cb84d9a83d75cef2c66944cf446b3b4f5f5ef8b8e5c7086ae28b9a6fdc2d3cb9f16cf7ee14286912009508a64a46d72984ca50b81
-
SSDEEP
24576:Wyy/xg/cLkfydPTFbcFbylqCnoRVnXYCNC5zakKpzK:ly/xg/lfEPTFgFbyY7nXDNsazpm
Static task
static1
Behavioral task
behavioral1
Sample
f4f953a7b360535eddf20493ca42b947ee72ebc0bf789fc3b47c4380625af48f.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
amadey
3.80
9c0adb
http://193.3.19.154
-
install_dir
cb7ae701b3
-
install_file
oneetx.exe
-
strings_key
23b27c80db2465a8e1dc15491b69b82f
-
url_paths
/store/games/index.php
Targets
-
-
Target
f4f953a7b360535eddf20493ca42b947ee72ebc0bf789fc3b47c4380625af48f.exe
-
Size
930KB
-
MD5
5ccc39fac47e68e392a6d0ec8718f634
-
SHA1
68fa1e22eeebefd68a0904b9ec824925fbbce5ef
-
SHA256
f4f953a7b360535eddf20493ca42b947ee72ebc0bf789fc3b47c4380625af48f
-
SHA512
34bc55db67e65b00df30a04cb84d9a83d75cef2c66944cf446b3b4f5f5ef8b8e5c7086ae28b9a6fdc2d3cb9f16cf7ee14286912009508a64a46d72984ca50b81
-
SSDEEP
24576:Wyy/xg/cLkfydPTFbcFbylqCnoRVnXYCNC5zakKpzK:ly/xg/lfEPTFgFbyY7nXDNsazpm
-
Amadey family
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1